Minutes of the meeting of the Audit and Compliance Committee of the Board of Directors of the Cook County 
Health and Hospitals System held Friday, December 10, 2010 at the hour of 12:00 P.M., at John H. Stroger, Jr. 
Hospital of Cook County, 1901 W. Harrison Street, in the fifth floor conference room, Chicago, Illinois. 

I. Attendance/Call to Order 


Chairman Munoz called the meeting to order at 12:05 P.M., then recessed the meeting to the call of the Chair, 
in order for the Finance Committee to conclude their meeting. 

At approximately 12:35 P.M., Chairman Munoz reconvened the meeting; the Committee began their 
consideration of the items presented. 

Present: Chairman Luis Munoz, MD, MPH and Directors Benn Greenspan, PhD, MPH, FACHE and 

Heather O’Donnell, JD, ELM (3) 

Board Chairman Warren E. Batts (Ex-Officio) and Gerald Bauman (Non-Director Member) 
Absent: None (0) 

Additional attendees and/or presenters were: 

Michael Ayres William T. Foley Deborah Santana 

Cathy Bodnar Tim Heinrich Thomas Schroeder 

Daniel Brennan, Jr. Elizabeth Reidy 


II. Public Speakers 

Chairman asked the Secretary to call upon the registered speakers. 
The Secretary called upon the following registered speaker: 

1. George Blakemore Concerned Citizen 


III. Action Items 

A. Minutes of the Audit and Compliance Committee Meeting of October 19, 2010 

Director Greenspan, seconded by Director O’Donnell, moved to accept the minutes of the 
Audit and Compliance Committee Meeting of October 19, 2010. THE MOTION 
CARRIED UNANIMOUSEY. 


B. Proposed 2011 Audit and Compliance Committee Meeting Dates (Attachment #1) 

Director O’Donnell, seconded by Director Greenspan, moved to approve the proposed 
2011 Audit and Compliance Committee Meeting dates. THE MOTION CARRIED 
UNANIMOUSEY. 


C. Any items listed under Sections III, VI and VII 
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IV. Report from System Corporate Compliance Officer (Attachment #2) 

A. Activity Report 

Cathy Bodnar, System Corporate Compliance Officer, presented updates on the following subjects: 
Activity Report; Compliance Issues; and Corporate Compliance Activities. Additionally, she presented 
information relating to draft policies and procedures. The Committee reviewed and discussed the 
information. 

With regard to corporate compliance activities, Ms. Bodnar informed the Committee that a cooperative 
collaboration agreement, between the CCHHS Office of Corporate Compliance and the County’s Office 
of the Independent Inspector General (OIIG), is in the process of being drafted. Ms. Bodnar also provided 
an example of an investigation of a situation in which a patient’s Limits of Liability application was found 
on Wood Street by an employee. She noted that record retention questions are beginning to increase; they 
are in the process of developing a record retention policy that is specific to the System. 

With regard to the proposed cooperative collaboration agreement with the OIIG, Director Greenspan 
inquired whether a related parties agreement would need to be executed, to ensure that the System is 
protecting patient health information. Ms. Bodnar responded that, although she had not envisioned 
OIIG’s assistance with those types of investigations, she would review the subject further. 

With regard to the subject of employee access to the finalized policies and procedures, Ms. Bodnar stated 
that a communications plan, which includes the utilization of electronic mechanisms, will be engaged. 


V. Report from System Director of Internal Audit (Attachment #3) 

A. Activity Report 

Tom Schroeder, System Director of Internal Audit, presented the Internal Audit Activity Update. 
Additionally, he presented a review of 2010 Internal Audit activities. The Committee reviewed and 
discussed the information. 

The subject of auditing contracts, with regard to goals met with regard to Minority and Women-Owned 
Business Enterprise (MBE/WBE) Ordinances throughout the contract life, was discussed. Elizabeth 
Reidy, System General Counsel, noted that a report was given to the Cook County Board, which reviewed 
the MBE/WBE participation on contracts. With regard to goals met during the contract life, Ms. Reidy 
stated that recently, the County’s Office of the Independent Inspector General did an investigation on the 
subject; she stated that she can try to obtain a copy of the report for the Committee’s review. 

Chairman Munoz stated that he would like to see a System review of MBE/WBE participation. Director 
Greenspan agreed; he recommended that a sampling of contracts be reviewed. 
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VI, Recommendations, Discussion/Information Items 

A. Report from RSM McGladrey 

Tim Heinrich, of RSM McGladrey, presented an update on the status of the internal audits. He stated that 
there are two outstanding audits - payroll and procurement. With regard to the payroll audit, they are in the 
final stages of finalizing the draft report; this is expected to be released and sent to the process owners for 
their input next week. With regard to the procurement audit, they are in the process of doing the testing 
phase within the next two weeks; the audit is expected to be completed by the end of the month. 

B. Update on Hektoen contract 

William T. Foley, Chief Executive Officer of the Cook County Health and Hospitals System, presented an 
update on the Hektoen contract. He stated that this contract was recommended for approval by the Finance 
Committee at their meeting earlier today; he noted that the System has been awaiting approval of the 
contract in order to begin the audit. Once the contract receives Board approval, which is likely to happen on 
December 17,2010, the audit activities will proceed. 


VII. Closed Session Discussion/Information Item 
A. Discussion of Personnel Matters 

Note: this item was taken out of order. 

Director Greenspan, seconded by Chairman Munoz, moved to recess the regular session 
and convene into closed session, pursuant to the following exception to the Illinois Open 
Meetings Act: 5 ILCS 120/2(c)(l), regarding “the appointment, employment, 
compensation, discipline, performance, or dismissal of specific employees of the public 
body or legal counsel for the public body, including hearing testimony on a complaint 
lodged against an employee of the public body or against legal counsel for the public 
body to determine its validity.” THE MOTION CARRIED UNANIMOUSEY. 

Chairman Munoz declared that the closed session was adjourned. The Committee 
reconvened into regular session. 

At this point in the meeting, the Committee lost its quorum; Chairman Munoz received 
information on Items VI(A) and VI(B) until the agenda was exhausted. 


VIII, Adjourn 


As the agenda was exhausted, Chairman Munoz declared the meeting ADJOURNED. 
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Respectfully submitted. 

Audit and Compliance Committee of the 

Board of Directors of the 

Cook County Health and Hospitals System 


xxxxxxxxxxxxxxxxxxxxxx 

Luis Munoz, MD, MPH, Chairman 


Attest: 


XXXXXXXXXXXXXXXXXXXXXX 
Deborah Santana, Secretary 
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2011 

CCHHS Audit and Compliance Committee Meeting Dates 
Meeting Time: 9:30 A.M. 


Tuesday, January 18, 2011 
Tuesday, March 8, 2011 
Tuesday, April 26, 2011 
Tuesday, June 7, 2011 
Friday, July 1, 2011 
Tuesday, September 6, 2011 
Tuesday, October 25, 2011 
Tuesday, November 29, 2011 


Approved at the December 10, 2010 Audit and Complianee Committee Meeting 
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COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 


C^HS 


DECEMBER 10, 2010 REPORT 
to the 

AUDIT AND COMPLIANCE COMMITTEE 

from the 

CHIEF COMPLIANCE OFFICER 
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ACTIVITY REPORT 





COMPLIANCE ISSUES (REACTIVE) 
BY CATEGORY 


2010 Fiscal Year End Statistics 
12/01/2009- 11/30/2010 
187 Issues 


False Claims 

Conflict of Interest 


13% 



Privacy (HIPAA) 
34% 


Issue Count by Category 


Privacy (HIPAA) 

64 

Accurate Books 

7 

Human Resources 

27 

Healthcare Fraud 

7 

Conflict of Interest 

25 

Theft 

2 

Political Activity 

15 

Other 

27 

False Claims 

13 




Active Issues 


In Process 
5% 

10 issues 



P@§§e10 of 57 






CORPORATE COMPLIANCE 
ACTIVITIES 

FISCAL YEAR 2010 


Increased Corporate Compliance awareness throughout the system 

- Communicated in multiple formats: posters, flyers, payroll inserts, compliance program 
business cards, pens with the compliance hot line number, and attendance/ presence at 
team meetings on numerous topics: general corporate compliance information, toll free hot 
line, HIPAA protected health information (PHI), HIPAA privacy and security, HIPAA 
sanctions, political activity prohibitions, and Shakman compliance. 

- Developed an intranet compliance page. 

Educated CCHHS 

- Developed annual training in general compliance and HIPAA. 

- Provided classroom style compliance training to new employees and members of the 
workforce, new house staff, and new volunteers. 

- Provided specialty HIPAA education to operational areas. Human Resources, Revenue 
Cycle, Information Services, the Emergency Department, and Health Information 
Management. 

Developed a mechanism for reporting potential violations 

- Migrated individual hot line numbers into one toll-free system level compliance hot line 
number available 24/7/365 (live answered not IVR). 

- Acquired a system e-mail address compliance(a)ccbhs.org 

- Obtained a secondary toll free hot line to respond to privacy concerns. 

- Acquired a secondary e-mail address for privacy concerns privacv@ccbhs.orq 

Restructured Corporate Compliance into a system level function. 

- Hired a system compliance coordinator and an associate compliance officer. 

- Recruiting for a system privacy officer. 

- Budgeted for additional staff within fiscal year 2011. 

Acquired tracking software to manage proactive and reactive compliance program activities. 

- Independently engaged external counsel to provide guidance on compliance issues. 

Engaged an external vendor to perform excluded provider sanction screening checks on vendors and 

employees, migrating the function from Cook County’s Management Information System. 

Initiated development of system level HIPAA policies and procedures 

- Engaged external resource to assist with the development. 

- Collaborated across business units with operational areas to identify existing policies and 
combine the leading practices into system level policies and procedures. 
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CORPORATE COMPLIANCE 
POLICIES & PROCEDURES 


(Documents will be distributed at the meeting) 


P@§§e13 of 57 



Cook County Health and Hospitals System 
Minutes of the Audit and Compliance Committee Meeting 

December 10, 2010 


ATTACHMENT #3 


Page 13 of 17 



CCHHS Internal Audit Activity Update * 


Audit/Project 

Complete 

Jun 

Jul 

Aug 

Sept 

Oct 

Nov 

Dec 

Mail Order Pharmacy 

X 








Impark 

X 








Risk Assessment 






Interviews 

Assessment 

Reporting 

Cash Management 

X 








Radiology Contract 

X 








Fixed Assets 





Planning 

Field work 

Reporting™ 


Compliance Project 

X 








Special Earnings 







Assessment 

Reporting 

PwC Benefit Validation 







Assessment 

Reporting 


Mail Order Pharmacy - review of operational controls for SAV-Rx, CCHHS’s prescription mail order vendor 
Impark - review of operational controls for Impark, Stroger and CORE parking facility manager 
Risk Assessment - assess System-side risks; development of 2011 internal audit plan 
Cash Management - review of safeguarding of cash 

Radiology Contract - review of service volumes and invoicing by CCHHS’s radiology vendor 
Fixed Assets - review of safeguarding of fixed assets 
Compliance Project - Dept, of Psychology review 

Special Earnings - review of special earnings expense category for physicians and clinical staff 
PwC Benefit Validation - validation of PwC benefits derived from revenue cycle initiatives 


Projects managed by CCHHS Internal Audit. McGladrey will provide a separate update on 
the projects they are managing. 



COOK COUNTY HEALTH 
, a HOSPITALS SYSTEM 

CC#fH5 
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Internal Audit 2010 Review 


The primary goal for Internal Audit for the year was achievement of the Board level goal of 
developing and implementing an internal audit function. To support this, a 10-step plan to 
develop the internal audit function was developed. 

Following are the 10 steps and achievements under each step. 

1. Establish Stakeholder Expectations 

• Met with each member of Senior Leadership to obtain input 

• Met with each member of the Audit and Compliance Committee of the Board to 
obtain input 

• Documented the above discussions 


2. Develop Internal Audit Mission and Vision Statement 

• Created mission and vision statements for internal audit; each were adopted by 
the Audit and Compliance Committee of the Board 

• Created an Audit and Compliance Committee Charter with the assistance of the 
Chief Compliance Officer. 

• Created an Internal Audit Charter 

• Both charters mentioned above were approved by the Audit and Compliance 
Committee of the Board 


3. Develop an Internal Audit Strategic Plan 

• Created an internal audit strategic plan and it was approved by the Audit and 
Compliance Committee of the Board 

• Reviewed the internal audit strategic plan with Senior Leadership and leadership 
from each of the business units. 


4, Assess Risk and Develop an Internal Audit Plan 

• Risk assessment and audit plan were developed by McGladrey 


5. Establish Internal Audit Budgets 

• An internal audit resource plan was developed and reviewed with the CEO and 
CFO 


6. Assess Internal Audit Skill Set Requirements 

• Determined a need for an auditor with a financial skill set and an auditor with an 
information technology skill set 

• Hired an auditor with financial skills in 2Q2010 

• Will begin search for IT auditor in 4Q2010 
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7. Develop Internal Audit Infrastructure 

• Acquired enabling technology - developed proficiency with Auditor Assistant 
which is an electronic work paper solution; subscribed to KnowledgeLeader 
which is an online internal audit informational resource 

• Developed and documented a methodology for performing internal audit work 

• Developed and documented internal audit policies and procedures to guide the 
internal audit department. The policies and procedures were reviewed and 
accepted by the Audit and Compliance Committee of the Board 

• The internal audit staff joined professional associations relating to internal audit 
(Institute of Internal Auditors, IS Audit and Control Association) 


8. Execute Internal Audit Work 

• Enabled and assisted McGladrey in completion of four audits (two additional 
audits are in progress) 

• Completed audits from McGladrey’s risk assessment and CCHHS management 
requests (petty cash, cashiering operations, SAV Rx mail order pharmacy. 
Impark, Psychology Department review). One additional audit from the 
McGladrey risk assessment is in process (fixed assets) 

• Two projects are in process (special earnings review, validating PwC revenue 
cycle benefit) 


9. Establish Communication Protocols 

• Developed communication formats for internal audit results tailored to the 
specific audience (e.g. internal management versus Audit and Compliance 
Committee of the Board) 

• Established, with the Chief Compliance Officer, a Compliance and Audit 
Steering Committee, composed of leaders from each of the business units 


10. Measure Results 

• Developed an audit client survey for distribution at the conclusion of each audit 
completed by CCHHS internal audit staff. 
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2011 Internal Audit Goals 


System 

1. Complete a refreshed risk assessment and develop and execute an internal audit plan 

2. Continue to increase Governance (e.g. Audit and Compliance Committee of the Board) 
confidence in CCHHS’s control environment 

Department 

1. Round out the staff by hiring an IT internal auditor 

2. Continue to develop staff in areas of internal audit theory, methodology, and concepts 

3. Continue to develop staff efficiency and effectiveness in performing internal audits 

4. Continue to develop internal audit as a collaborative business partner within CCHHS 

5. Move to a primarily CCHHS staffed internal audit model 

Self 

1. Continue to broaden and deepen relationships with CCHHS leaders and managers 

2. Continue to build on healthcare industry knowledge 

3. Continue to broaden and deepen relationships with peers in health care internal audit 
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